@TRSJon, I figured it out, the first column is just incorrectly called 'Source role' probably from another export template lazily left there; the actual column based on devtools network tab in the request/response payloads is 'SourceType' which is validated to be one of 'user','domain','group'. So if the row represents a user, that column would be 'user', if group, group, etc. This was a huge PITA to figure out what should have been a documented thing.